Nesa chain exploited through Cosmos EVM flaw: about US$50 million of NES moved, attacker's net gain estimated near US$60,000
Nesa's blockchain was exploited on 24 Aug 2026 through a Cosmos EVM flaw. About US$50m of NES was moved off-chain, but thin liquidity left the attacker an estimated US$60k. Nesa says it has patched. NES holders should use only the new official contracts.
If you hold NES, use only the new official contract addresses Nesa announced on 6 September, and follow your exchange's swap instructions. Ignore unsolicited messages offering to swap or restore tokens. Nothing else is needed from other families.
What’s happening
On 24 August 2026 an attacker exploited Nesa, a blockchain built on Cosmos EVM, and withdrew about 257.7 million NES tokens (roughly 25.8% of stated supply, worth about US$50 million) to Ethereum. Nesa confirmed exploitation of a Cosmos EVM vulnerability but has not published a post-mortem, the exploit transaction or the victim account. The flaw matches one Cosmos Labs documented, in which delegating locked vesting tokens through the staking precompile makes an account balance wrap to a huge number that is then used to take another account's balance. Cosmos Labs fixed it in v0.6.2 and v0.7.2 on 19 August and did not name Nesa in its post-mortem; applying that mechanism to Nesa is supported by Nesa's statements and bridge records, not shown at transaction level. The attacker sold into thin liquidity and reportedly kept only about US$60,000. Nesa says the chain is fully patched. Its explorer was unusable on 8 September, and no restart date has been published. Binance Alpha planned a 1:1 swap to new NES contracts and resumed trading on 10 September. No recovery, bounty or arrests were reported in anything I read.
- What
- Breach
- Affects
- Nesa (NES) blockchain and token, built on Cosmos EVM
- Fixed in
- Nothing to patch
- Since
- 24 Aug 2026
- Closed
- 10 Sept 2026
Timeline
- Update
Binance Alpha planned to resume NES trading on 10 September, with a 1:1 swap for NES held before deposits closed on 24 August. As of 8 September Nesa's public explorer showed no usable data, and no technical post-mortem had been published by Nesa. I found no later reporting.
- Update
Nesa issued a follow-up statement calling the attack pre-meditated and saying the chain was fully patched. It gave no technical detail, loss figure or restart date. It announced new official NES contract addresses on Ethereum and BSC the next day.
- Update
Cosmos Labs published its post-mortem. It said a researcher reported the flaw on 25 April, that it wrongly judged the risk low after testing only a six-decimal network, and that six chains were hit between 20 and 25 August. It did not name Nesa.
- Update
Reports said the attacker kept little: the stolen NES was sold into thin liquidity with heavy slippage, for an estimated net gain of about US$60,000 (Bubblemaps). The coverage mentioned no recovery of funds, bounty or arrests.
- Made public
Nesa was exploited through the same Cosmos EVM flaw. The attacker moved about 257.7 million NES, roughly 25.8% of stated supply and worth about US$50 million, from Nesa's chain to Ethereum. Nesa said only that it had identified malicious behaviour and would restore services after a fix. Bitvavo paused NES deposits and withdrawals the same day.
- Update
Cosmos Labs released Cosmos EVM v0.6.2 and v0.7.2 with a fix for a balance-accounting flaw, describing it only as important security fixes. The first attacks on other Cosmos EVM chains began about 20 hours later.
Sources
- NesanRekt · 10 Sept 2026
- Cosmos Labs says it wrongly cleared the bug behind a $5.7 million six-chain hackThe Block · 29 Aug 2026
- Cosmos EVM Hacker Minted $50 Million — and Walked Away With Just $60,000Yahoo Finance (BeInCrypto) · 27 Aug 2026